KSE Enclave Key Generation for Edge Cloud Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current cryptographic key exchange methods for securing connections between edge devices and cloud datacenters are vulnerable due to the exposure of secret private session keys and certificates on software servers, which are susceptible to cyber-attacks, especially when Root Certificate Authorities delegate their authority to secondary CA entities connected to the internet.

Innovation Solution

Implementing a Keys Security Entity (KSE) enclave to generate master keys and one-time connection session keys, which are then securely output to a Connection Security Entity (CSE) enclave over an encrypted link, while preventing access to the master keys and periodically verifying the state of the CSE enclave to prevent compromised sessions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If cryptographic key exchange algorithms are implemented on software servers for session authentication and encryption, then the system can handle huge scale of millions of simultaneous connections, but the secret private session keys and certificates become exposed to theft by hackers

Engineering Contradiction:

Improvenumber of simultaneous connectionsVSAvoidsecurity of private keys

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system separates key generation and storage functions into a dedicated Hardware Security Module (HSM) that is physically isolated from the software servers handling connections. The HSM generates and stores private keys in a secure environment, while software servers only receive public keys and encrypted data for processing. This segmentation allows high-scale connection handling on software servers while maintaining key security in hardware.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The HSM acts as an intermediary between the trusted Root CA and the software servers. It receives requests from software servers for cryptographic operations, performs them in a secure environment, and returns results without exposing private keys. This intermediary role enables software servers to provide high-scale service while the HSM protects the security-critical functions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If Root Certificate Authority delegates authority to secondary CA entities connected to the internet, then the system can provide widespread certificate distribution, but the delegated entities become vulnerable to cyber-attacks

Engineering Contradiction:

Improvecertificate distribution capabilityVSAvoidcyber-attack exposure

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The critical security function of private key storage and protection is extracted from the internet-connected secondary CA entities and placed in air-gapped HSMs. The HSMs are physically isolated from network connections, eliminating cyber-attack vectors while still enabling certificate distribution through secure cryptographic operations. Software servers handle the distributed certificate management while HSMs protect the root secrets.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system uses short-lived session keys and certificates that are generated, used, and discarded rapidly. Each connection session receives unique cryptographic credentials that expire immediately after use. This approach limits the window of opportunity for attackers even if they compromise a secondary CA entity, as the compromised credentials are already obsolete.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Ease of operation

If secret private session keys are kept in software on servers, then the system can provide easy access for authentication, but the keys become open to theft enabling hackers to control private secret data exchange

Engineering Contradiction:

Improveauthentication accessibilityVSAvoidkey theft risk

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The system replaces software-based key storage with hardware-based security modules. The HSM provides a physically secured environment for key storage that cannot be accessed or modified by software attacks. Authentication operations are performed through secure hardware interfaces that prevent unauthorized key extraction while maintaining ease of use for legitimate authentication purposes.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11909874B2Secure confidential use of communication session keys

Publication Date: 2024.02.20 HUB DATA SECURITY LTD

AI summary

At least one non-transitory computer readable medium, that at least one non-transitory computer readable medium stores instructions for (a) generating master keys by a keys security entity (KSE) that is established within a KSE; (b) generating one-time connection session keys, by the KSE, based on the master keys; (c) outputting, by the KSE, the one-time connection session keys to a Connection Security Entity (CSE) enclave in which a CSE is established, over a secure communication link; and (d) preventing access, by the KSE, to the master keys.